535336ff7cf09ecc5dbde4903f9e1594d04ac614c3eacd445f144f895ab9e625

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_51b5d8562939591c884cf0b96c378f6e_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Size 783KB
Sample260905-mxk2hsdc99
SHA256 535336ff7cf09ecc5dbde4903f9e1594d04ac614c3eacd445f144f895ab9e625
MD5 51b5d8562939591c884cf0b96c378f6e
SHA1 d176d8b34a73dd63d97edd9a6b8d5cc1b2c6ea30
SHA512 c819adc728b39954b4d9ad4a397fb06da775e521a23714cdfbd1097bcdca9028273d5ee1322fe827b73d10a9e3aa8a65844d79415e5800b21cb6a4b2c6aaa3cc
SSDEEP 24576:cryr+I4rvxLnjuBSHsu2UhowloNLQWozS:zr4rJLjJsu2UCSoN0vzS
TLSH
T1EF05011270E2C0B6D572093909F4BAB05ABDB8700B659F7F23E45B2F1E751C1962AE73
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
4204	alg.exe
4260	elevation_service.exe
5092	elevation_service.exe
5064	maintenanceservice.exe
3656	OSE.EXE
6836	GameInputSvc.exe
3344	GameInputSvc.exe
5284	msdtc.exe
3416	PerceptionSimulationService.exe
1780	perfhost.exe
5556	ReFsDedupSvc.exe
6788	locator.exe
4756	SensorDataService.exe
4216	snmptrap.exe
4880	ssh-agent.exe
2524	TieringEngineService.exe
6852	AgentService.exe
7000	vds.exe
5836	vssvc.exe
6808	wbengine.exe
4284	WmiApSrv.exe
6192	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Drops file in System32 directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-09-04_51b5d8562939591c884cf0b96c378f6e_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-09-04_51b5d8562939591c884cf0b96c378f6e_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\45719634957eebe4.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	alg.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\updater.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	elevation_service.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	elevation_service.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_51b5d8562939591c884cf0b96c378f6e_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe

Checks SCSI registry key(s) 3 TTPs 42 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	GameInputSvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	GameInputSvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	GameInputSvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	GameInputSvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3344	GameInputSvc.exe
3344	GameInputSvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4552	2026-09-04_51b5d8562939591c884cf0b96c378f6e_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
Token: SeDebugPrivilege	4204	alg.exe
Token: SeDebugPrivilege	4204	alg.exe
Token: SeTakeOwnershipPrivilege	4260	elevation_service.exe
Token: SeTcbPrivilege	6836	GameInputSvc.exe
Token: SeBackupPrivilege	5556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5556	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5556	ReFsDedupSvc.exe
Token: SeRestorePrivilege	2524	TieringEngineService.exe
Token: SeManageVolumePrivilege	2524	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	6852	AgentService.exe
Token: SeBackupPrivilege	5836	vssvc.exe
Token: SeRestorePrivilege	5836	vssvc.exe
Token: SeAuditPrivilege	5836	vssvc.exe
Token: SeBackupPrivilege	6808	wbengine.exe
Token: SeRestorePrivilege	6808	wbengine.exe
Token: SeSecurityPrivilege	6808	wbengine.exe
Token: 33	6192	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	6192	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	6192	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6836 wrote to memory of 3344	6836	GameInputSvc.exe	97
PID 6192 wrote to memory of 264	6192	SearchIndexer.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-09-04_51b5d8562939591c884cf0b96c378f6e_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_51b5d8562939591c884cf0b96c378f6e_amadey_elex_luca-stealer_njrat_remcos_smoke-loader.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4204

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:5092

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5064

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:3656

C:\Windows\System32\GameInputSvc.exe
C:\Windows\System32\GameInputSvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6836
- C:\Windows\System32\GameInputSvc.exe
  "C:\Windows\System32\GameInputSvc.exe" Global\GameInputSession_1
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:3344

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:5284

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3416

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1780

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5556

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:6788

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4756

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4216

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:4880

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6852

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:7000

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5836

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6808

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:4284

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6192
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 4467ad3dd64b505aa3493c73d2d51e0ca6e607f2a1727f88adbbc6fe58d60fab
MD5 9c654b8dab0b13b2223e0ba955f919dc
SHA1 0aa3d4cfee825b3407abbf078025afb10c365abe
SHA512 6436ccb89a0b1464d5403970c4b49122f9bc1d3bbc8721082811b298cccacd0ab8ddd75b214151684f22643c00c4c03cf5a5e8d0459b9c17b54e4969ca4e61f0
SSDEEP 49152:Lb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnQJsu2UCSoN0vzSk:Z3q6gjBzJH287
TLSH
T106D59D03F2D900E9E069D178D7469133EAA2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 845KB
SHA256 302d27a0524aeee531704f523e219a9809dc526afd8462804f1989a02315a1e6
MD5 df60337a9819fa5bb5a1b673d0835d20
SHA1 cc5159fc32f4a7bd0b6473fd82f9f78091caf4f5
SHA512 b9759ac75851832172b6648c200d53b97b27e22d756a90b0b25430d1f18aa6d89d8d80c56a432261729f166c7aa3db998b8d778b8f5f788a6b37cc084c65dd8f
SSDEEP 12288:P1XLsgSgsxy2lRq2czAajFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWjS:tXYdJtczAajuBSHsu2UhowloNLQWozSk
TLSH
T12605F129B3E409F9ED67813DC9B19511E673B89143A4E78B03F4D92A1F232C85E3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 3a77df936a0c5d047c97ed11b2b2084f9c079d01fba57f1588a29a907d6893fd
MD5 cbd626f5d822e349ee9b79d03e9ed7bd
SHA1 ef70ab0e3c01f8c160591877dcb097cf91d71f51
SHA512 bd3700a7b9e67544e23c44c74b27e9fe38d1bd2ed304cf8ccf3697ac4596383e0b8d6431c42cc11e5a59c07b4b55bcc915435b7a410b081c7b1e16ba9b93ff1b
SSDEEP 24576:f03exqh0f/xOrMljuBSHsu2UhowloNLQWozSk:frqh0HocJsu2UCSoN0vzSk
TLSH
T11235AE26F6748335D073C0B9C5D2A69AEA71308257308ACB4396D77C3E676E6C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 0f832108ace4177d02672ea410e17cc5f7af7773c9d30438812a63e75dd3e285
MD5 64df8c987b6c2960d6dac5b5a350599a
SHA1 2a410a7262b6e1312344c1ccab6d873e85461079
SHA512 a1bdd039cb496c96c4ef892dc7ba2fdbec40b4e547ef7e7b213f92d2f84db835a9428fd8c485fd04288fddbe0c0230bb5817b158c1afa8665acf7f9dd0fc8d62
SSDEEP 24576:Q2w/ezSC6vUyD/aqgrvW/6q8wyuRjuBSHsu2UhowloNLQWozSk:4/ezSC6vUzPvuHjySJsu2UCSoN0vzSk
TLSH
T12C755C25F5788323D0B2D0BAC5D6BA9AFE723046573089CB0246D76C3E276E6C536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 2282467d713ee70e5f25e27018dc03642dc45d9d39efb5b9061ca37825582a30
MD5 46a66a5ee783e66e18229a2cdc1ab1e3
SHA1 07b8f63756cfdefa72520e3b83d560c3338aba8b
SHA512 dbaa08fe671a3d42c64388ddb2bf571e5b46e1f12c85baf65f0d5f54f38a0cde163850383b6d233d9b6f3df6e607906e03563949735c37c084c7da05132a8f4b
SSDEEP 24576:gabFPxm28v/l+dJjuBSHsu2UhowloNLQWozSk:gafm28Xl+vJsu2UCSoN0vzSk
TLSH
T1C7559E66F5748331D073C0BAC5D2AA9AEE3230425B318ACB1346D76C3E676D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 599KB
SHA256 5eb136de596684cc1c74ed0899c38f6a30379a112285cd3e7a5d712caf858f42
MD5 a78a825c2ee0c29b70c0c085137eba8b
SHA1 97f4c0dc97a21d359b59133aa68ec372b8fe8f71
SHA512 376f91c5aa88d5934cbdcb5f2b8164090a561cd65737653f6c5824cfc228b95e2f37c511277f2213b4ae66f8eeb82d69ab8f78bfa65dd220430859dd44c1de2b
SSDEEP 12288:OTTjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:OTTjuBSHsu2UhowloNLQWozSk
TLSH
T1F2D4236792A8973EEF51143F66F878B10355A8E0539AB30553F1FE0F107608CFA6BA25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 859KB
SHA256 23e768e43e020199c36a97d3c1d9e1e8759753744037f88902c0ee68b142787a
MD5 1175505262cb5e83d8c2716347226541
SHA1 47ce056487e1e84ab762536621be218d08c20b92
SHA512 dc7be12a40983b1ac5553a83da8eae304d13511f91aa392dfa44789fe2edfa1edddc4366b61b10ae5c2adbb293bb2278a283a6995b9b367fb5a94dfa278c3adc
SSDEEP 12288:weBNUbTVO86UyvjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5Ak:wJIUCjuBSHsu2UhowloNLQWozSk
TLSH
T14815DF3BEE28FCE2C67A4D795B908600977274704B62A3CBD275C30E9E235D45E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.7MB
SHA256 654664950c7e17e32cc246e43f86db33e77a171c043248c1f8cbb691d9887434
MD5 081fec0f160ac14c86f03711d848e4ed
SHA1 ddc88df9c7be6a9fc29164edfa78a853e772e02e
SHA512 ed3f14c1cb95188d0d2af422bdcf17eb040f94e1eb253c977e708033216cdcbe824f153dcb47a0afa5a9b7d3dc3ffaed71ad402308872686e67bb7b550f5936f
SSDEEP 49152:pQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJJ9DN5JvNRV3THb:pQvGAdlCEL8c/JRNT5CEJH287
TLSH
T142367D656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 928KB
SHA256 f28e786ae62a467f0d343348997ad3b144dda350a73966847bc3bd2cea251fc1
MD5 dc453e17289d936bd2f87ebc5fb1bcb7
SHA1 75131bc388f671ced012da364e146de0786cc4bc
SHA512 de7af148104c7c18dc78743740ba5810f354b485ec8dce82e6c7525dc20091df5f38b9ef1307a30aec5265c6f2b3f5ea6293decfcb04639ab1cefe37273c4a75
SSDEEP 12288:LzwSfxL/2Dc3bDLLmt0LDQewsAj8jFM+wq0wyqHsuP101U6vASOGfFFre9loNGMi:/mewsAj8juBSHsu2UhowloNLQWozSk
TLSH
T10C15E031FA74E036C67B0DB61B35D716142DB9604BA12AC3E3F89E8E59301C26776E27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 207d328117e1513225d6636d3430ae68562d60a7d397c7eafdda237ff51fd489
MD5 a0b893ff62996361d34027e71f46d01e
SHA1 4c430cbf3e6504501ea6f4a44d9d5e51223760a5
SHA512 cc90d00793ab95c95ea7c4c5b18e61c3682a0402924b190fd5a0fb4c6c65791e10cc1df03a24177492b33d9f1ee2b1273ab73186c50567f19de6058cf3ebc597
SSDEEP 196608:zUEtQeTbvf2zlO12sJTv6Ja1cpVLyXrodPlbuJHkJ77:zUEtQevvqc2W1cpV2XrM247
TLSH
T1B9474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 2dbfa3e6cae4b4ad4c7f0ca3643a55f95bd9a351a681af069ca3cf39cd96ba0e
MD5 e4eb748fad773a7ed812868f6cede342
SHA1 5a51026afe7faf1700af5e5c9f85de35bbde8b83
SHA512 9826e50c1f428e6a30d67de109b12e4cf53a2d0d4926296f2aa3014d172269fdf9e126c2724c68ee71b66fc885d00754dfdd18013140b0a98141762ffd073749
SSDEEP 49152:OQbRquA/m2yL5zMfFiV+XenmE3/z3Jsu2UCSoN0vzSk:Zoq1VjnmkJH287
TLSH
T13ED58D0976B8C2E4D1F6C77886A2C647F37178154B35A7EF4266460E2E33AD58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 dc0a0af722bfdec422fc91a35106059d656b9e767622a9f40bb353d426140124
MD5 51a93311d78c87a7d5fc554dfed59036
SHA1 4bf8e46dea27718ff41818dce32ccbfa919742ee
SHA512 e4b55baa646a0693022df1a8ef58419bb78d11a6c3bbd493e04edcfdd6af7d9a279d78c50142b8de7f0814c017871c3d73801115d099d2192cf9102fd9a1a9ad
SSDEEP 24576:LAhGLvrFoiwtA5l7S53DjuBSHsu2UhowloNLQWozSk:LAMvFoiq5XJsu2UCSoN0vzSk
TLSH
T14845AE81E7F945D4F5B3AA7899B69171EA76BCA65E31D30F2260D10F0E33A409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 825KB
SHA256 d2a6dba4cef7553e8bd54299dba277692b16532542cbabb01270f211ac68552a
MD5 206c99c80023bcdc190d8aecbc79f919
SHA1 21aff86def72f7f180604423ad41bf7248098ecb
SHA512 7c1c16711fdaab2e418a7144fb016a3ca8da7c3db9f745539f7b942221a4f36cfb50ca4e6b68faab350de7297a3c8b366fe50da8b530c2edbc0c9e3e3ce90cbb
SSDEEP 12288:5mw5HEjsChNhBFgl0WDm+C6jFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3b:Uwu8OWHjuBSHsu2UhowloNLQWozS
TLSH
T1F805F14672E80CF9E967813D86A79536E7B2B8512725D71F03B0C61B6F33251BD2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 674KB
SHA256 918c8d5e37a567655127b6adc71e146d8ae2f2b65035b1fcc1afb235c9fd6ee8
MD5 c02e02e9f7f9554fe3c3ab90c317ff55
SHA1 9a3304dbdb7ad7e8239398176578c30430abe25e
SHA512 0890deb7c6e7e0743544302656d987246717c43852f38f1c1bb0de8d309ee84e5a6d22c94f1719ea9d5e290d0fea49b0b81da311a75bda04229b5e5965d7a17c
SSDEEP 12288:FUr1IV+DjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:CruUjuBSHsu2UhowloNLQWozSk
TLSH
T104E4129A33E462B9E6A3413D99F465519372B0A1237653CF03B0961F2F335C5AE3A732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 878a68dfd99786f56f08cdd4662ab7270a09fc64917d7648684d162fcc96dfff
MD5 bc4e46191ef2298bd351e4edb2d207ec
SHA1 6aeb449a85fb2599b009769f3ed8f1e47bb3e922
SHA512 bef193febb919445006523a09a89dff2c8cc878ccdc410252c2c170f0861f8920e348eabdf351146db71a6b507f9a0a824c8d80995422b5f20b02e00facf2f27
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23U/:4QRQyi36YOcP8Lvw2gAf+PN35JH287
TLSH
T142666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 5affe2775eb16b25b8414dfb87e597abcacdc60b8be2d85addc5f76a3b8d7a2c
MD5 6dc2e937dc4de61af40505cd42aff329
SHA1 dd376489c5b95f82034c2432d703a149269efaca
SHA512 b8f86de504507788c0f7399ae119cdc895e96c5e6808edf66e1fb95871d4aa460a23d1dd4d2d10d5a2499f156af67a272a268245711a28f1cba82719e5ad6fd9
SSDEEP 49152:Rj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeIAaLSF259ruMHwpXMi4FqJLd23Ur:4QRQyi36YOcP8Lvw2gAf+PN3tJH287
TLSH
T1EA666C13F3A501E8E05ED974CF3956229B357C4A8BB093EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 105856dec8957a695c2a3340ea8d98b1d96ba842c044943b0781fa36af944f84
MD5 2cead08a3ff3b816820c619909a68582
SHA1 932e953cbe8fd5aec045ff2e7457ea2c1b0f997a
SHA512 c092ddc123183cc91e45e7e5c6fbf7a146fea6590bc0e99c4360fcfd314f984ad56881c17b02367f96b07c69d4a75734330c590bd2470b7f2b4ef9d7df987309
SSDEEP 49152:o68Qg55nhMeWu7PNU3/TJsu2UCSoN0vzSk:ythbRc/TJH287
TLSH
T131B55A33B2F600A9C44DE1769F4A973196D17C718FE1E3DB825172061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 5902ea5a0cffc1027384fa70e3acc6fbaab2a1a79905bd7c2853df0d5dab8572
MD5 16276348ca53f82635833e4064cdfd4c
SHA1 ed429aa63f73050fd8b065ed613ac4ccc3f33843
SHA512 99df006ea30e61ad0fcf6c46f048c3fd7c0d1e216c600501cba382712252e3596d74609e7acdb63d833fb0c9dd49b90a61e55a1b422320ff4b7a9d06d699f6c0
SSDEEP 49152:U3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbWN3Oh6tznm2FQ/nho2qkrk99s:By5112gYy5azzVv569nLKnhZjJH287
TLSH
T150167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 2ce932758e82b894e09cfa3d9dea6e450a8b76dc40d2fe01a7be90b0b7a21c8b
MD5 56b63d02acc98788e5554089f6298c2c
SHA1 891978ee9ec16070dfd2a668bfd6203676416d5d
SHA512 956b31873248cfdce2acd0ce50ab1a66d2b92363bd7cffe8254bd44e2201e7a96aba41384b3def2352803422de6b6819658dbf7adfae49ba8ca0e6bc79738fa1
SSDEEP 49152:QB+taZ3usBWOBr4tEGp0bqx0z+n217aau1glsJsu2UCSoN0vzSk:Ku6JmTxd2dsJH287
TLSH
T19FD59D13F1D901E8D06ED478974AA233EA62BC490B35B6DF0B9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 5c5105c5f9b09d0d9b4398707681070429bf161122dcc9f7748bc0536df99963
MD5 9cbf5d8af43efb1f344f65ef3f15c826
SHA1 f3b24e77b6439b7e36fc291d23a298adcacbd79d
SHA512 ed21d9bb3de18386c4f1d515f857c533d9c7c511972a6828fd44cccb7a0e79f23c198c1a45bf71667d693005d48f11ee01130616e2b596f0658faa6d44acaac0
SSDEEP 49152:S1hpsNoJpF1A6UU44CwH7R4xPJsu2UCSoN0vzSk:SmifPbRyJH287
TLSH
T19CB5BE13F2D901E8D06DD17887569232EA62BC450B34B6DF0A90B7961F7BAE46F3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 c2b1fbb6a98cb970a4410dc45e3a398eaf311f0a424fe0de92c02c6c45037272
MD5 1e2ca41efd7eb8f07f1b967e62d4a5c4
SHA1 7c7f80a48fcc6592eb116f824be211654aae5ec1
SHA512 382ed312044c3e18293735af40b64bf6f867c60c687d6c54f22dfb83d94e36f5df6c3e837ddfe2f5e3b1cc75a79d058a95b604804aaaa28ef2dc89080053be80
SSDEEP 49152:sSuZQIY0Be2K6RVtOnks6NMHqIJsu2UCSoN0vzSk:O5dKoi61IJH287
TLSH
T173C5BE03F2E941E8E0BED67887659232EA72BC464B34A6DF074072591E77EE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 69c26a829147d3db212fd98614f6ba307eb268e2b6fd2df0f442ac8bd3bc2597
MD5 47fc0881e70357f506d56f1c8f35a109
SHA1 7c4db8ce7fb38f317db770b47b3793d84ae7a4d6
SHA512 6f58372faf4fee59e50f7c9fb640ea9932e34fc5dcfcdd748152770001af96b472a24f5acb769478618f465cfbe011659b1967336953df4e9ca0dd1db13a71fb
SSDEEP 49152:HhtSn8EApI0figTgiDn0AP5wHJsu2UCSoN0vzSk:WX2iyphKJH287
TLSH
T135A5BE13F2D901E8D05ED078C7568632EA62BC150B39B6EF0A90B7561E7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 598KB
SHA256 2fa7fa2f0afe1a993486ff99c0d3d9585313e90aee551121dd9d044f58881969
MD5 643c629ec8dd7df110b4ab3013b2beac
SHA1 6e878a1fc5343a437eb55513bfc0f008987f854d
SHA512 e44e464124f5e46b6e83e7c2a4a533e1792c7240164fa7ea5473ba42ae22f816ee58064d0cb4d7e48a7b59607483c16016f7827068d383e960a2e15e79bbcbdd
SSDEEP 12288:ZPZjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:ZRjuBSHsu2UhowloNLQWozSk
TLSH
T179D42367A5B9873EEE01143F56F834B50245A1E1A3EA730563F5F90F217308CBA5BE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 598KB
SHA256 dd1399cc9213e79a731fb56353e23595bedccc8fdc7e7a27d095757da321de12
MD5 7efd70f22e4cd4ef1e34e5f1ed380a42
SHA1 7762f6ee4474fedfabf32e96072ec8fb445347a0
SHA512 8bd671b2d7a08bbc5b114a9d01222f4675e088ca4b2baada187923f6dcf9872c1ff296119a96eb795bd39c417a1919ee1236317da5923a2b68d691761fd27fd1
SSDEEP 12288:/jZjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:/VjuBSHsu2UhowloNLQWozSk
TLSH
T1C7D42367A5B9873EDE11143F56F834B50305A1E1A3EA730563F5F90F216308CBA5BE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 598KB
SHA256 43178463fb833065f706ea38c3cd3aacb3d92b27d85e006f0f6ea0bcd7e3fca8
MD5 f77761ca7cc4b63e7bcb3d01a7a12f2b
SHA1 a478542c6ba6e915f612217112be21cc5cb16683
SHA512 a971efefee9cb7759fa3072f2d2b51a05cd304a455ff242d75169f68077fe8d99bfa9c8904a85db1425b060fc80a9227a7576ba05c5eef150f7253ec2194d0c5
SSDEEP 12288:NUejFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:NfjuBSHsu2UhowloNLQWozSk
TLSH
T1CBD42367E5B9873EDE01143F56F834B50355A1E1A39A730963F1F90F212708CBA5BE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 618KB
SHA256 a5552b8a4c9a9134d2878a7d5f27aeb6573c3d7c71ec8ccca3c0e0479c72b1e1
MD5 8bf29a5cdbe157675f407408365f7925
SHA1 7a1423445997577e65360d3cf4d2aee8b194b577
SHA512 1215313637702a5e7f2f475476a0f1d4e897035a1ed080491f167e7c915a7039af462f4ff6eeaf19e413e4171ce1e7ab025ad86c284e77f7960d9018a2cd1400
SSDEEP 12288:SlIajFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:+juBSHsu2UhowloNLQWozSk
TLSH
T122D42367A3B843BADD11913E95F474715365B4E0A376A30F53B0A90F1A7318CF92AF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 598KB
SHA256 1e21408f31178f360c43084c794dcaf1c5e449df29cdb928fea783c0a2b40287
MD5 8013fc5adc30db085bce7cd8ee58cf69
SHA1 28b2b265e13824bd2d1014f2145cf30f28b299b4
SHA512 23f59c1e908f7e664134c06bfcabd31e99629832e7c05d8a9901a00282d48bb3f33fb205cc7fa94e23b970bff8910b2dd18a7cb38567593de84347414c7d0e21
SSDEEP 12288:sV6jFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:sAjuBSHsu2UhowloNLQWozSk
TLSH
T197D42367E1B9873EDE01143F66F834B50245A1E1A39A730963F5F90F216708CBA5BE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 598KB
SHA256 287964d71347721eab2f7ffb9c45690257a125f346170d93a43847c97b8735a3
MD5 8cece03d0010ad3c59a829768be2e42d
SHA1 fefebfe72370b1081866cb1670c404a7ec9ab06c
SHA512 517f07373d4b5335666f2479d7697963c7088604b35e7500c50b554ac7d9f5fec78724f516b1850570318a526584f4d959233bbffcff49c425e3780e3a9cf401
SSDEEP 12288:vA5jFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:vIjuBSHsu2UhowloNLQWozSk
TLSH
T188D42367A5B9873EDE11153F56F834B50305A1E1A3DA730963F1EA0F216308CBA5BE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 598KB
SHA256 472c02118ce8ee65d0896793fa76920895d8ce28fbaa21236315a2a8c22f35e2
MD5 2c09cd1480ed537a7a0ae770b66b0ae2
SHA1 3ff173075d742af4aa06fbe8f8e9a46a3d88bb04
SHA512 f503e7461d033b357caca772a92020c25d38660ac6b1e49a410d0ff76b092036babd01204a9674c9fb5c5da6b6f725a148a94e2449af5144dff132554b57978a
SSDEEP 12288:oSzjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:o0juBSHsu2UhowloNLQWozSk
TLSH
T1DBD42367E5A5873EDE11143F56F834B50345A1E1A3EA730963F1E90F216308CBA5BE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 859KB
SHA256 e49770620e91e4d692adde432743243dbb416914f609646fa65146db4ac05b4a
MD5 4d272ad61fdc26141b0b221d143aeae6
SHA1 d59b6d8a6c1212a2fb88925182d1dea803b4f1d5
SHA512 f0921d1661d31a8f0ee0338649cfe27d9567cd679eb96d6cdc6d8a3f5b0e5630aba49cac71990cf81746c38032df6b19be3c4e79f5629ecc0f215da8aa2465fb
SSDEEP 12288:UiZwbMmzCEoSbcPvyuFjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8j:3ZMtzCVSbejuBSHsu2UhowloNLQWozSk
TLSH
T11215F1A5B3A019F8ED63813E89649916D2B2BC6507A0C71F13F4362B1F333915D2EF69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 598KB
SHA256 e6b589ecc43a44b661d3d91c1cf1e9dc69034426a91a2b20ec0cbdf0e5ce6dbe
MD5 884ce4427866d117d932b3f46f2e6529
SHA1 fd85e4520cf37ad6d91aafe7bb3a5235a9e92299
SHA512 f6a23dd44d9cb5125201bd8d13b76bd857ad84a24a76e0b749d759f11b48d126503bccf29c5b915b6d151de2bb547a25897c9aa0676f3d99576830cd85c55512
SSDEEP 12288:dL/jFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:dzjuBSHsu2UhowloNLQWozSk
TLSH
T1EFD423A7E1B9873EDE11153F52F834B50244A1E1A39A730963F5F90F212308CBA5BE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 598KB
SHA256 fb20d9e087be969c1f0089342a2c23817caa5fb19df408e4d7a542e5c4c6435d
MD5 4cbd65d379d289cb5130498a89425354
SHA1 e313df49b2ef4afc31fef1ddc1c306ad71d74d80
SHA512 9055b97a102f38447d5780768ed344f03ad0fbded31efae324d0de9635d3cd67a85c33282207d5919336866599bb00f24e843e56a84bbed7943443c37bb21b56
SSDEEP 12288:vT/jFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:vrjuBSHsu2UhowloNLQWozSk
TLSH
T153D423A7E5A9873EDE11153F56F834B50204A1E1A39B730963F5E90F213708CBA5BE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 736KB
SHA256 15747a0dade7c8f0516648657a0a3d495f8d760a4dbfa11f9626a041a9ed7c31
MD5 67491c19601c0dfce2b05bdc61e0a6d5
SHA1 2276a14b25c2519a85f92a2e885e97aba8e77d6e
SHA512 1c9511d5c962f3a5b3fb001d847d868676b81a76fc0533560830333dd08e6c5a5990264bace6bf073cc9a045b38aa899dbb44de5784e7718f0b0ce50f8aa0f0b
SSDEEP 12288:r4Pz5L0t6jFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:kzaYjuBSHsu2UhowloNLQWozSk
TLSH
T128F4125773A521FDD522823D89A12952F372B47207659B6F13B0477B2E23294AE3FB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 598KB
SHA256 9ba17bda3128480d2fe9930a3f348a4e6f06513ea4325543675b6ce3d3a6a5b0
MD5 699f75b930a5d7ca2e01db3cf0a72faa
SHA1 98717ad69b5845ae0c6626227cc269bf9a1ba13a
SHA512 f4c83064f82f9d1c1019558c7c1b43aa246567f73e30664bd96ca585c27201b6f2d55116e6bf97a4b5b93ab3957e24afbae44edc1bb593354a5b64cb660a5529
SSDEEP 12288:RXbjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:RLjuBSHsu2UhowloNLQWozSk
TLSH
T16AD42367E5B9873EEE11143F56F834B50215A1E1A3EA730563F5F90F212308CBA5BA78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 598KB
SHA256 2e8b98157f94f9aeee7a766a47ca8d49f27da5cdf8cb5e44a17f7c3c16c45629
MD5 02633e725480e573588e9758c0c0ed3f
SHA1 166ddd1197f7c66ee1c02a4e706216925104ccd6
SHA512 c1693f419ce1e5b0aec7563127ca3ee7509bcb5919023a64b1f77c93ba167bb9c8a4a28693fc1a2d0116b631aac2c805e45060d578a2a45520f1610f640254fd
SSDEEP 12288:poXjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:p6juBSHsu2UhowloNLQWozSk
TLSH
T14DD423A7E5B9873EEE10143F56F834B50245A1E1A39A730563F5F90F216308CBA5BD78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 736KB
SHA256 057f2121d263c14f64ee59f55608519d26a74ec44e66e14a10c4b35003492cda
MD5 f81a0f97f8d6b2f22960a53d67d321fc
SHA1 07633be15a2e2b5d9cc845478d0b558f9af6b804
SHA512 4ff68683adfd8288c3fbfe027685ab31272e97af7e41a2ddd2e4bb5909a94ed7a08eafe4c0fa35c8101b8beb981546640707388b06b4de1f97a46a381c81337d
SSDEEP 12288:i4Pz5L0lSjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:BzawjuBSHsu2UhowloNLQWozSk
TLSH
T17CF4121773A521FDD522823D89A12952F372B47247659B6F13B0477B2E23294AE3FB30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 859KB
SHA256 3dc05f01dabaaa7507659a2e9203378348405a6a300c04886570c0dd0c20a429
MD5 ceeeecd4ca9ebc2c647d0d5719cde1b5
SHA1 8aa9a24945632ded481b7a9e1bff1d61808b4711
SHA512 49fa802c8cdd8eb413964797d30a729374189acfa5806798e07c9b90a58b182aa21e8b7587153db2e3dfc62d779643690376fef12be110f9f1bc9c6eca89f57d
SSDEEP 24576:6TOaLl3z0zcdzjuBSHsu2UhowloNLQWozSk:6T9Llj3Jsu2UCSoN0vzSk
TLSH
T1FC15F1A5B3A018F8ED67813EC9655916D2B2BC6607B0C71F03F4362B1F332915D2EB69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.0MB
SHA256 c9f59107eb620c8c934576dd65a39dc87a1e6db4d7372084fdd84b9e8522b333
MD5 5921f182ef6fbc6467059273d57cf7f2
SHA1 21577c485bc873c3291a575ff34ef0eb51c5eab3
SHA512 18d06f4ef69b2348548eba796450754d8fb71a26f589fa9a47b1284ff0e9ce57e388b5b4a71b1984175f0080603059b8933e82511f485f2b75d635ce59697f66
SSDEEP 24576:y3LdBCHZy7QZFsjuBSHsu2UhowloNLQWozSk:ULdBCHZy8iJsu2UCSoN0vzSk
TLSH
T15035DF90F3E411E8F0B39A3989755512DAB67C9A1B31DB8F03A4661A1F336D18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 598KB
SHA256 29e0df967e9ccf7ba0e263ccf4de8802996cdca5160dcb02593f909c7855ef18
MD5 f69a2417790c6e1fdc06cad1c4bf1223
SHA1 cf43d2415d5c33534f9e8191d0d7a1ea91ba575d
SHA512 9219c132e0ebc4aa7e351484c8e8966cfc1828858dc5b5b7ae4536acb429cad76d06218a4b17265eafcd1f93e28265fe94a8393ee5cb889b91826042327416b6
SSDEEP 12288:rNQjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:rNQjuBSHsu2UhowloNLQWozSk
TLSH
T181D42367E5B9873EEE01143F56F834B50245A1E1A3DA7309A3F5E90F212704CBA5BE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 598KB
SHA256 0063947c24ef21d0fd86c5d14726c78e8434ed2f63f6b5dfe52d8665b35986e6
MD5 3c721aaecc86ef9f9a99d2cee08fa9ba
SHA1 c5d5201faad10c22d2d4beea4dcb33a6c6bbb31d
SHA512 d9e815851e15349778d9a3d0cb71ab103b23cacf93a58b46a461846cfc60c5783c99beef56872b961671aceb34c7ca582c7ab4e5740828b746ddab43a5693681
SSDEEP 12288:ZDfjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:ZDfjuBSHsu2UhowloNLQWozSk
TLSH
T13AD42367A5B4873EEE11143F56F834B10345A1E1A3EB730963F5E90F216704CBA5BA39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdb.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
Size 598KB
SHA256 cf6cd12d3ae8654bbd75e5c23af5d8a6fa008650393fc9f1488eb232890e76b6
MD5 796f3ec61cb8a8295482c0b534f854b9
SHA1 46945c36b1a92019012676b24b096a1c9503bd4d
SHA512 6d98deca963ef67ac658f2889d4064030a4d0fe4d9c34fac4d9eb9781987e11d3411e806ec387834e3dc3e747e96701cc3096fcf13839910791232bfcbf5a085
SSDEEP 12288:suNjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:suNjuBSHsu2UhowloNLQWozSk
TLSH
T15FD423A7E5B9873EDE10143F52F834B50245A1E1A39B730963F5E90F216708CBA5BE78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jdeps.exe

Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
Size 598KB
SHA256 3515e214f90bc0dfedc646782bb6bdd8c2a4a66c483e1504d5d4b36b160dba64
MD5 849b9a3e43bb015307621abd01af942a
SHA1 eeb52286d9d2a8036a7be9b35f28c98efbaf9443
SHA512 c93d936af766a78522f00e793331090f22c4ee571bcf5155f7197790fbc3dc5d2764d0deae93595e74e3427989b08a5aa9fcd08617fbf6f866100ea2ec61f544
SSDEEP 12288:PRNjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:PRNjuBSHsu2UhowloNLQWozSk
TLSH
T1DBD423A7E5B9873EDE10043F56F834B50245A1E1A39B730963F5F90F216708CBA5BA78
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 718KB
SHA256 18f116d03666fc8b37e8bebe66a0d46269b7c949c8f871421e5b161baa10d45d
MD5 8a2517ef95c45c0c6316e5d0c99289fe
SHA1 015c1f6aebaafe64a76c297244929df4257ebb3a
SHA512 ea00f7271df6358087589402aea3959f66ce61f07f8166b599f8674b2d0cdfed130caf369096c947207a642153d29f62511761d8438ee564b48b6a8106680ba3
SSDEEP 12288:RHsfjjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:8jjuBSHsu2UhowloNLQWozSk
TLSH
T19AF4011AD29842E9C46E513AC7A46951B3337C6193E1E3CA53E0F53F1F36184ADEAB13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 606KB
SHA256 e8b982a8a9a9cd4cae7064a52ea017ef54d169264ef6e26f988067e82e041bda
MD5 2f7e64b4ef90a6d4f3d409e3cc6c752b
SHA1 090b6d63b2a711c34fd8b4c9356ab4887df3a6f3
SHA512 3df84f3911c22d5013ae762d05aea00c256dae2e3ab0090b87222f2645d5381cfdfa8ff2c366f5bdae6be6dba35ad7c46b0d16dcb4ab1ab66a0904e469292e92
SSDEEP 12288:6n7jujFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:8ajuBSHsu2UhowloNLQWozSk
TLSH
T17CD42367E2A88B2AED65153D11B874711319B1F05795A347A3B1FA0F24330CCFD7AB2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 690604a1d0deb69493f3f4141743329d0894d5a048c27c42f198e8466952f842
MD5 eed7d48b8d7fe6171c315c1a590b43b9
SHA1 086ed216292ce504ae16d50b26c8ae1d9bb7c550
SHA512 466adb8faa9b72f08e9bcd1cf1bf074aae6a5b253bed0f949d64690b860fd8f33b095aefca3b338cbde6b0b4cbcfa12a52b2c80bc1ae72e54eef32d35eb8db08
SSDEEP 24576:Lgb6bmBIi49WNNFpg1rSvFv7bYOjuBSHsu2UhowloNLQWozSk:Lgb4mBIBhGFTJsu2UCSoN0vzSk
TLSH
T18365AF1E22EC02F5E0F5D2B8DDAA4417D6B278161732D2DF1251422D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GameInputSvc.exe

Path C:\Windows\System32\GameInputSvc.exe
Size 656KB
SHA256 19f9dd3409ff6c808cf79ad9af331bd9dd442072c41c2309328a4e9c6996006f
MD5 b72113f12975653311ba6953384737ae
SHA1 6b86d7de1ab48384eb99da89ff17ef3110f6b643
SHA512 9c0999baab1f32e594784b0e002d1207f2ee388e3555d6031c687e2179a9cdd96d51eb674e761e1033f2637482c25fb99cbe373047edcc394ef44c9af98cabc1
SSDEEP 12288:a8GwjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:bGwjuBSHsu2UhowloNLQWozSk
TLSH
T1EFE4226E61F962ACCD35823E55B474B2326170E0536563EF43F0E93B5B260D4B63EE28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 620KB
SHA256 89da8ab8410fed5612074d2b9bbe90e54f50ccd8f891b09162c642e81821aac5
MD5 13a851d813f01c8fde9eb67ed26c6364
SHA1 1bc61bd7506cf9a9ba7a6d5cd81f44b1c792ef2d
SHA512 642920bbc5684b904a328d2f84f0007e8286775204933119c269b22c6b4940c6771f322b22805108f7c599b5b44945fda820cf61400800214be8b672cf5571e6
SSDEEP 12288:gZjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:gZjuBSHsu2UhowloNLQWozSk
TLSH
T1C3D423A7A1A8872EDE51153E15F478711305A1E053AA73C763F1FA0F21670CCFA7BA29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 af4b7ac572cbc374a0dd70fccfe1c11700e0dbd60ffc6a8667ef53c371e254af
MD5 6c8f31f9553a01715ca5fc59e80d723f
SHA1 3dda3028d98949455fd921c0610449e5f4675c2b
SHA512 a70265ace9a956d93bd1a96afd5ec09ddcb0633b70ff516e8daf2e0f2b3def16dccc8f755ccff00f3ff3b807309bfe3d98cae96139d79d1393b8647e0d718efa
SSDEEP 24576:rEE8u8FpJqH1vzria7/myjuBSHsu2UhowloNLQWozSk:YDZFPqVya7/XJsu2UCSoN0vzSk
TLSH
T1AB35F166B6E002F1D477D1388A964663F6B2B4210364EBDF07A88B561F236D44B7FF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.7MB
SHA256 6d55de9ed9e7e6e05705d18d0dbc7e2debc5252b11641e2158a07967eb4a5e96
MD5 c91af894687d7a18f0017e137c7111d2
SHA1 90d12e4188f29b4a99229b0df645a1d2a5951ee8
SHA512 b1844df20843ae5f19d6222eb88542d4a5f04975e26b76489a5b1396b880cd913ddaed3080fdb479038747b4de9ff61332f5a96b6e657b9aa533e030747053f0
SSDEEP 49152:fBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjDJsu2UCSoN0vzSk:QG05lO43bSJH287
TLSH
T1F1D5CF6A62EC11F9D1BBC17CDAC6460BEBB23415033556CF02A486A91F27FF4A97E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 8c17fdd885e523650601372b1c80fef798e1c6de91a8086abd82cedc5aaf8d8d
MD5 6323c6ca31b34f8f3c96dd3b74690936
SHA1 e10a9ad0a5cc40c6442fee0cb77ed8c8a8b68cdb
SHA512 7909b2736c2b9f982d61ed3f8bae0bb08826776d0c2e29ccb5c4d72a458cc6415d21435d3f0c30ae6d0cf28a70f0a654cdec28a16e56449c92180a9ecd385108
SSDEEP 24576:Mla5POZ3dpbWVM50JicR2hG0lasx2+47eidnujuBSHsu2UhowloNLQWozSk:Ga5POZ3wJt2pasx2+m6Jsu2UCSoN0vz/
TLSH
T12C65BF5EA6FC01D5D5B9D17DC583461AE5B1342253329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 c45615eb3a4ef7c7e4a54e18f364795f54b1b94507e21d5c1cc91129449c0775
MD5 4edb641f4c37176e55de29ef1786078a
SHA1 9ad6c1460f78af1de6b387ba33d466f286988151
SHA512 cb36c4c670b1ba0b0f5d2daf94577d72b883f8106ddd96adf66bcfee33629991cfa8ac5539a6329313563dad2ea6e9a0f64bcdb2e510022ac1319feb77ad0479
SSDEEP 24576:7NcwHdjbyQ4nLC18lb/EOjowL7FkqjuBSHsu2UhowloNLQWozSk:7Nc/zEOVHF7Jsu2UCSoN0vzSk
TLSH
T10A857B2623E901E4E5BBE1BE89779546FA717865133086CF0391851F1E73BE46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 928KB
SHA256 6a3a74a01289062815095be35f530a6f1b446d7d4d7d22af8f6d4f8e28e24396
MD5 6d90b192f61810b86b72c2095959d4dd
SHA1 40c0d0ee862ff808258462fb941388c70dc4ee89
SHA512 e0cd03ca88008248ac4be221563d201883f37704d028c0ecca9b880eb7437ffacd912abd99674a34bd4d4fdf005dee088bf6c3078ac66b32b77d10127d42409d
SSDEEP 24576:yJnJPbzB4S9juBSHsu2UhowloNLQWozSk:yJnJv6SRJsu2UCSoN0vzSk
TLSH
T1D815E13DD2A810E8D4B7C2788159276AFF31347C2B266AC716B4D5353F12ED0AA79F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 901add9dce6e613e3de09b44cdabc84e2a98af62338d5217ba46099542e6b294
MD5 689ede0fb6a4ab027d70cb4333436c68
SHA1 5fab35c43544640cb31bc76d0b21c2f2fa42b0d3
SHA512 fb7ce3e870d74e80e67911cea8ea57f93619b51bb3954aedf1718473b01dcf6727153c64d04bd7bae784b30b824c53bca686f4a33637cf309613be7625b349a5
SSDEEP 49152:qCLHGeeV5ijCmlDWDk1Jsu2UCSoN0vzSk:x7JH287
TLSH
T16EA56C05E7EB4184F8F3CAF5CA2694169A327C549B34F7DF4A80CA6A1E32BD4D538B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 772KB
SHA256 29f69ed682aa012f51816bc3386a06aa9823fc0dcf73681a38bc83301400be83
MD5 bd31614bd455a582b06a49d83b748876
SHA1 4c8b61dc01dca05e0f5a496985583d5a0838adbd
SHA512 a28be826f0b58f97138fbfcb47a2cb0fab15fe4732cc1b32d597a2c2af1b000eceffc5f0706938099b93d08420f6e2221586c3fc444d7e8775e03a2f6a906bba
SSDEEP 12288:I1Hck6j5ZI7aRjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:I6DIujuBSHsu2UhowloNLQWozSk
TLSH
T16EF4015D63BA11B9D167D03E86920412D2B2B0B0836267DF07E4C97E5EA3ECCB93DE51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 756KB
SHA256 4afaccf8853edb0223f8b9560a7cbe77a1c9d5f2f65d799691c898ae50147fcc
MD5 dd7e29c3ce82a6b91e7a4252109aa1cc
SHA1 5db2073145d37ad210811f043f25c169e368c6cc
SHA512 7d1b699e5d21e78e991da508370a223504050ca27156bf20735761b17ef4f0440be8a9ef9f0e1f80a59c473d45fd5492f18f1f9747329a09b1df3082653f0d33
SSDEEP 12288:aG6kyZjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:ztyZjuBSHsu2UhowloNLQWozSk
TLSH
T1CDF4120563A851A9EA75013D9AB160B04B35BC60576263DF53F0FA2F2E332C8BD36F25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 628KB
SHA256 55984ce8ffbaba5c428e9fb220712fcf676315f6d97a76454e702ed28c5e3ff6
MD5 165ea8e8c3c3030d1a6b3b2de486c1a0
SHA1 a5930427d498f92f78fea7f132010acd595f85d8
SHA512 4de122a2425a4eecf132d6aeecc377be20fe3f3d232096ba76406716ed12546ca6104d7c0b985052e45a9498fe683417ea59b46bea84be231baebc2f7c3560e4
SSDEEP 12288:FTtjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:5tjuBSHsu2UhowloNLQWozSk
TLSH
T1CCD423AAA2B8576EDD10553E11B435B10215B1F053AA73DF63F0EA2F52370C8BA7BE14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.2MB
SHA256 ecf161d2365ba3886e8d50e5d4af93d88e56c253b998fba21ce29e7f20bbe33d
MD5 4c32d3a6399d53f2ae6debe85f53303a
SHA1 ade04b4f4764382ef1598516ea6c55e0df283c18
SHA512 e2b66c29da1e59885a0afdaa251f2aea135e521a68362b85439ad5ff0c28701b78e70a60ea72c70b88c7802d8144198f87e751c938bf728c73ca2ad6349cd142
SSDEEP 24576:ztgRLoTfaidZZjuBSHsu2UhowloNLQWozSk:RgWTrZVJsu2UCSoN0vzSk
TLSH
T112559D1D63EA05DAE2B2D239D8721493D633B4315372D6CF2558C03A4DABED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 788KB
SHA256 da9a3e26f6a9d37b735167a3ad02708dc49ec45cab42e7f0ab6334341a55afb1
MD5 7c19bbc8e65c632927f916bee3203e8d
SHA1 2eeb47c0086974501c6d4dc723d0944dc507405e
SHA512 e9018fdd3724ff0d613ff2353d6545e1d52e466529d8b78642a1971ac26ac893e38354acd59a91ddabf52c41c03dbd22ed2c62a1d92402dbdacdcab600f8a30c
SSDEEP 12288:upJcm8CNEjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5AlC:urcmREjuBSHsu2UhowloNLQWozSk
TLSH
T18805F15EB2AE00BAE1B7813C89914556E2B3B070635263DF03E1C77E4A275DDBE39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.0MB
SHA256 df122ce1cd92f312764144e7b66cf07b31f4ebe0c5f4e096c9a788819f36298d
MD5 e763f583cd14c865cfc17b0060eb647c
SHA1 1cd0e45869e57282b0b48c5b9f43d6989e7fdf49
SHA512 07a546ca818ede0fb5872cfbfd7761563c7018bb2d94dd11b3a419eb66cb14c692636b75501f68f79d9653b66768ef84d606c2c58eb5ff021d3ae71c77e058e2
SSDEEP 49152:6DL0mXk3y67q64Uy37XoeF8+q43UpTc5BnS3bJsu2UCSoN0vzSk:73Upow8sBKJH287
TLSH
T1ECA58C3DA2E800A8D9AAC379C54213A6EA71742E3F3015DB0174C578BF1BDF19A39F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 824KB
SHA256 f6c2f75b1f935faee3d81127f70106263353189f5f39d7137be088935d316919
MD5 240c3b12872722375e930513295b02a1
SHA1 f966ae875a2ca4d49d939f6d0432ee592b800284
SHA512 756e4dc8b2f75999deeefa34f6a6e0c7f2a9b44165644628f82ceba5344a5e9fde0d80d275ab96608f3f9bb691215ba9bcfe47a23ff0f441cfb32229a6a45f17
SSDEEP 12288:eHvUrBFrEjwaQsjFM+wq0wyqHsuP101U6vASOGfFFre9loNGMcUOU3QWj8htv5Ak:ePUr+NQsjuBSHsu2UhowloNLQWozSk
TLSH
T15A05E12F62EC18E9E676A13D85955619E371B4621312E3CF03E0817F1E679D8BD3EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1780-275-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/1780-359-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1780-269-0x0000000000400000-0x00000000004AD000-memory.dmp

Download

memory/1780-270-0x00000000009B0000-0x0000000000A19000-memory.dmp

Download

memory/2524-330-0x00007FF6447F0000-0x00007FF644983000-memory.dmp

Download

memory/2524-407-0x00007FF6447F0000-0x00007FF644983000-memory.dmp

Download

memory/2524-332-0x000002BB74270000-0x000002BB742D6000-memory.dmp

Download

memory/2524-331-0x000002BB74270000-0x000002BB742D6000-memory.dmp

Download

memory/3344-243-0x00007FF6FC1E0000-0x00007FF6FC2A7000-memory.dmp

Download

memory/3344-245-0x0000027D6D810000-0x0000027D6D876000-memory.dmp

Download

memory/3344-244-0x0000027D6D810000-0x0000027D6D876000-memory.dmp

Download

memory/3344-329-0x00007FF6FC1E0000-0x00007FF6FC2A7000-memory.dmp

Download

memory/3416-263-0x00000199554D0000-0x0000019955536000-memory.dmp

Download

memory/3416-260-0x00007FF6E9080000-0x00007FF6E91C8000-memory.dmp

Download

memory/3416-350-0x00007FF6E9080000-0x00007FF6E91C8000-memory.dmp

Download

memory/3416-262-0x00000199554D0000-0x0000019955536000-memory.dmp

Download

memory/3656-59-0x0000019033C50000-0x0000019033CB6000-memory.dmp

Download

memory/3656-57-0x0000019033D00000-0x0000019033E58000-memory.dmp

Download

memory/3656-58-0x0000019033C50000-0x0000019033CB6000-memory.dmp

Download

memory/4204-63-0x00007FF715AB0000-0x00007FF715BD1000-memory.dmp

Download

memory/4204-15-0x00007FF715AB0000-0x00007FF715BD1000-memory.dmp

Download

memory/4204-16-0x0000020756060000-0x00000207560C6000-memory.dmp

Download

memory/4204-17-0x0000020756060000-0x00000207560C6000-memory.dmp

Download

memory/4204-18-0x0000020756060000-0x00000207560C6000-memory.dmp

Download

memory/4216-387-0x00007FF7DAA60000-0x00007FF7DAB12000-memory.dmp

Download

memory/4216-312-0x000002DF72BF0000-0x000002DF72C56000-memory.dmp

Download

memory/4216-313-0x000002DF72BF0000-0x000002DF72C56000-memory.dmp

Download

memory/4216-311-0x00007FF7DAA60000-0x00007FF7DAB12000-memory.dmp

Download

memory/4260-30-0x0000021E3F050000-0x0000021E3F0B6000-memory.dmp

Download

memory/4260-29-0x0000021E3F050000-0x0000021E3F0B6000-memory.dmp

Download

memory/4260-28-0x0000021E3F110000-0x0000021E3F268000-memory.dmp

Download

memory/4260-31-0x0000021E3F050000-0x0000021E3F0B6000-memory.dmp

Download

memory/4284-449-0x00007FF6EA2E0000-0x00007FF6EA40D000-memory.dmp

Download

memory/4284-380-0x000002A63F1A0000-0x000002A63F206000-memory.dmp

Download

memory/4284-384-0x00007FF6EA2E0000-0x00007FF6EA40D000-memory.dmp

Download

memory/4284-381-0x000002A63F1A0000-0x000002A63F206000-memory.dmp

Download

memory/4552-0-0x0000000002E10000-0x0000000002F3A000-memory.dmp

Download

memory/4552-1-0x0000000002F40000-0x0000000002FA9000-memory.dmp

Download

memory/4552-7-0x0000000002F40000-0x0000000002FA9000-memory.dmp

Download

memory/4552-6-0x0000000002F40000-0x0000000002FA9000-memory.dmp

Download

memory/4756-445-0x00007FF710270000-0x00007FF710685000-memory.dmp

Download

memory/4756-379-0x00007FF710270000-0x00007FF710685000-memory.dmp

Download

memory/4756-303-0x0000028A6BF40000-0x0000028A6BFA6000-memory.dmp

Download

memory/4756-302-0x0000028A6BF40000-0x0000028A6BFA6000-memory.dmp

Download

memory/4756-301-0x00007FF710270000-0x00007FF710685000-memory.dmp

Download

memory/4756-443-0x0000028A6BF40000-0x0000028A6BFA6000-memory.dmp

Download

memory/4880-390-0x00007FF741010000-0x00007FF7412B2000-memory.dmp

Download

memory/4880-322-0x000001926E1B0000-0x000001926E216000-memory.dmp

Download

memory/4880-320-0x00007FF741010000-0x00007FF7412B2000-memory.dmp

Download

memory/4880-323-0x000001926E1B0000-0x000001926E216000-memory.dmp

Download

memory/5064-45-0x00007FF7DB340000-0x00007FF7DB4A7000-memory.dmp

Download

memory/5064-54-0x00007FF7DB340000-0x00007FF7DB4A7000-memory.dmp

Download

memory/5064-52-0x000001A9BDBB0000-0x000001A9BDC16000-memory.dmp

Download

memory/5064-47-0x000001A9BDBB0000-0x000001A9BDC16000-memory.dmp

Download

memory/5064-46-0x000001A9BDBB0000-0x000001A9BDC16000-memory.dmp

Download

memory/5092-37-0x00000167F0A10000-0x00000167F0B68000-memory.dmp

Download

memory/5092-39-0x00000167F0C90000-0x00000167F0CF6000-memory.dmp

Download

memory/5092-38-0x00000167F0C90000-0x00000167F0CF6000-memory.dmp

Download

memory/5284-253-0x000001F9059B0000-0x000001F905A16000-memory.dmp

Download

memory/5284-251-0x00007FF6298F0000-0x00007FF629A08000-memory.dmp

Download

memory/5284-252-0x000001F9059B0000-0x000001F905A16000-memory.dmp

Download

memory/5284-338-0x00007FF6298F0000-0x00007FF629A08000-memory.dmp

Download

memory/5556-368-0x00007FF7D4440000-0x00007FF7D4B82000-memory.dmp

Download

memory/5556-284-0x000001F0B5F90000-0x000001F0B5FF6000-memory.dmp

Download

memory/5556-285-0x00007FF7D4440000-0x00007FF7D4B82000-memory.dmp

Download

memory/5556-286-0x000001F0B5F90000-0x000001F0B5FF6000-memory.dmp

Download

memory/5836-361-0x0000024D2DF20000-0x0000024D2DF86000-memory.dmp

Download

memory/5836-362-0x0000024D2DF20000-0x0000024D2DF86000-memory.dmp

Download

memory/5836-360-0x00007FF643450000-0x00007FF64391F000-memory.dmp

Download

memory/5836-447-0x00007FF643450000-0x00007FF64391F000-memory.dmp

Download

memory/6192-391-0x000002DEC4900000-0x000002DEC4966000-memory.dmp

Download

memory/6192-393-0x00007FF65BDF0000-0x00007FF65C12D000-memory.dmp

Download

memory/6192-392-0x000002DEC4900000-0x000002DEC4966000-memory.dmp

Download

memory/6788-292-0x00007FF75B8F0000-0x00007FF75B99C000-memory.dmp

Download

memory/6788-375-0x00007FF75B8F0000-0x00007FF75B99C000-memory.dmp

Download

memory/6788-294-0x00000179EFFC0000-0x00000179F0026000-memory.dmp

Download

memory/6788-293-0x00000179EFFC0000-0x00000179F0026000-memory.dmp

Download

memory/6808-369-0x000002CFB9B10000-0x000002CFB9B76000-memory.dmp

Download

memory/6808-448-0x00007FF6F41C0000-0x00007FF6F46C5000-memory.dmp

Download

memory/6808-370-0x00007FF6F41C0000-0x00007FF6F46C5000-memory.dmp

Download

memory/6808-371-0x000002CFB9B10000-0x000002CFB9B76000-memory.dmp

Download

memory/6836-319-0x00007FF6FC1E0000-0x00007FF6FC2A7000-memory.dmp

Download

memory/6836-236-0x000002790E390000-0x000002790E3F6000-memory.dmp

Download

memory/6836-235-0x000002790E390000-0x000002790E3F6000-memory.dmp

Download

memory/6836-234-0x00007FF6FC1E0000-0x00007FF6FC2A7000-memory.dmp

Download

memory/6852-345-0x0000020802380000-0x00000208023E6000-memory.dmp

Download

memory/6852-339-0x0000020802380000-0x00000208023E6000-memory.dmp

Download

memory/6852-341-0x0000020802380000-0x00000208023E6000-memory.dmp

Download

memory/6852-340-0x00007FF6B8570000-0x00007FF6B888F000-memory.dmp

Download

memory/6852-347-0x00007FF6B8570000-0x00007FF6B888F000-memory.dmp

Download

memory/7000-351-0x000002AC25C80000-0x000002AC25CE6000-memory.dmp

Download

memory/7000-353-0x00007FF772BB0000-0x00007FF772E39000-memory.dmp

Download

memory/7000-352-0x000002AC25C80000-0x000002AC25CE6000-memory.dmp

Download

memory/7000-446-0x00007FF772BB0000-0x00007FF772E39000-memory.dmp

Download